The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 - Exploit, Third Party Advisory |
21 Dec 2023, 19:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Soflyy
Soflyy wp All Export Soflyy export Any Wordpress Data To Xml\/csv |
|
| CPE | cpe:2.3:a:soflyy:wp_all_export:*:*:*:*:pro:wordpress:*:* cpe:2.3:a:soflyy:export_any_wordpress_data_to_xml\/csv:*:*:*:*:*:wordpress:*:* |
|
| References | () https://wpscan.com/vulnerability/0a08e49d-d34e-4140-a15d-ad64444665a3 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-352 |
18 Dec 2023, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-18 20:15
Updated : 2024-11-21 08:42
NVD link : CVE-2023-5886
Mitre link : CVE-2023-5886
CVE.ORG link : CVE-2023-5886
JSON object : View
Products Affected
soflyy
- wp_all_export
- export_any_wordpress_data_to_xml\/csv
CWE
CWE-352
Cross-Site Request Forgery (CSRF)